The easy story about NIS2 goes like this: it’s yet another bureaucratic Brussels regulation; the CISO handles it, a consultant delivers a binder before the auditors arrive. Executives could hide behind a corporate veil. If their company suffered a data breach, the organization paid a fine, the PR team issued a hollow apology about how seriously they take customer privacy, and life moved on. Done and dusted.
NIS2 destroys that comfortable illusion. In our recent CRMKonvo with Claus-Michael Sattler we discussed how this story collapses on contact with three simple facts. There is no certificate to buy. The obligations travel down the supply chain. And the people who sign the budget now answer for the outcome with their own money. For organizations that call themselves data-driven and customer-centric, the last fact changes who cares about the CRM.
TL;DR
If you want to watch the full CRMKonvo, please go ahead here (optimized for smartphones) or here (optimized for tablets/computers).
Else, be my guest and continue to read.
Or do both …
No Certificate, Many Auditors
Claus, an interim CIO with four decades at the intersection of IT, operational technology and executive decision making, started with the basics. The NIS2 Directive names eighteen sectors, from hospitals and water supply to manufacturing, waste management and the financial sector and more. Inside those sectors, the thresholds bite at roughly 50 employees or €10 million in turnover. In Germany, where the implementing law took effect in December 2025, this adds up to around 30,000 companies.
But here’s the twist: there is no certification. Compliance is what the audit says, and the audit is what the buyer writes into its purchase contract. I pushed on this during the show, because a rule without a certification process ends up defined by whoever does the auditing. Claus disagreed: the rules are in the law, down to risk management and documentation. Both are true, and that is the problem. The law specifies what has to exist. It does not specify any way to prove it, so every large buyer becomes its own certification authority.
How do you even know you are in scope? Claus's answer was refreshingly blunt: ask the politicians. The directive’s annexes use NACE codes for parts of manufacturing; the rest is sector description and interpretation.
The Cascade Reaches the Local PC Dealer
The most instructive story involved a 35-person metalworking supplier to a major German chemicals group. The buyer's procurement department moved to cancel the contracts because the supplier was not compliant. A board member at the buyer called Claus, because losing that supplier would have stalled a large part of production. The supplier had no IT department. It relied on the local PC dealer. So the local PC dealer had to be brought into compliance too, because he now sat in that supply chain.
This is not a bug. It is the design. Article 21 makes supply chain security a mandatory part of risk management, and risk does not stop at the first contract. In simple words: your compliance boundary is set by the weakest small business having a key to your systems.
Claus sells this as competitive advantage. A supplier with a completed audit is in pole position when defense goes shopping, and, quoting Ron Dennis, the second is the first of the losers. I do not buy that beyond the short term. When compliance is a contractual precondition, it stops being a differentiator pretty soon. It becomes table stakes; the consulting industry around it will thrive. In defense supply chains, where Claus noted that NATO AQAP requirements and NIS2 travel together and the customer only knows zero or one, early movers win. Everywhere else it is a timing advantage, not a strategy.
The Management Tool Hidden in the Paperwork
The real benefit lies elsewhere as Claus emphasized upon. It lies in NIS2 being a management instrument. In one assignment he took his 32 IT staff to a weekend hotel and worked through his NIS2 checklist for two days. The output was 45 to 50 pages: what is compliant, what is open, what could be better, and where the team should be in twelve to 36 months. The findings included unsegmented networks, production systems with direct access to business data, integration paths running both ways. His successor received the document and knew his roadmap on day one. That company was not even in a NIS2 sector.
His second example was a pharma company with 72 firewall patches in one year, under GMP and FDA change control, because the vendor shipped credentials it should not have. Claus counted 252 days of patching effort that nobody pays for. NIS2 put the risk onto paper, and the paper forced a decision. The vendor was replaced with another one, which gives contractual commitments on backdoors.
That is the real value. A documented risk register turns "IT wants money again" into a decision the board has to own.
Personal Liability Is the Clause That Moves Budgets
NIS2 makes the management body approve and oversee cybersecurity measures, and it can be held liable. This is not a bureaucratic slap on the wrist. It is a massive re-centering of enterprise priorities. Germany's implementation obliges directors to approve, oversee and train, and voids waivers of resulting damage claims. Claus put it colorfully: your houses, your accounts, the private wealth you worked your whole life for are at stake.
He cited a ransomware attack on a Caritas social services provider. It lost hospital, care home, kindergarten and Meals on Wheels data, went bankrupt, and prosecutors are now examining the managing directors' responsibility.
Co-host Ralf Korb named the mechanism: the moment the law reaches into your pocket, cybersecurity stops being an IT topic. Regulation running on fear of personal ruin works. It is also a confession that years of GDPR fines did not change enough behavior.
CRM Is the Crown Jewel, the Supplier Interface Is the Side Door
For a CX audience the consequence is simple. CRM and ERP as one data environment: no sales without CRM, no business without ERP. Lose access for four to six hours and sales, delivery and production stop. The most critical CRM weakness is not exotic: disaster recovery after a hardware crash, with weekly backups and untested restores.
The attack path is the one CX architectures often ignore. A supplier pushes production data into a buyer's ERP; an egg producer reports daily quantities into a retailer's systems. Every partner portal, marketplace connector and integration user with write access to your CRM adds to your NIS2 exposure, whatever the marketing says.
Then, there’s the sovereignty. There’s the Patriot Act; the instrument that matters for data held by US providers is the CLOUD Act, which lets US authorities compel US providers to hand over data wherever it is stored. That is a real issue for European customer data. But "European" and "free of backdoors" are not synonyms, and replacing every US vendor is a budget few can carry. Ask about applicable jurisdiction and contractual commitments vendor by vendor, not about the flag over the headquarters.
AI Agents Are Employees Without an Employment Contract
Claus's view on AI is decidedly unromantic. It’s statistics and stochastics on fast computers. Still, an agent is a digital twin of an employee, one that can produce plenty of nonsense and needs a human in the loop to confirm that one plus one is still two. Ralf’s addition: it creates misery faster than any human could.
Taken seriously, the employee analogy has consequences. Employees get onboarding, role-based permissions, supervision and an exit process. Too many agents connected to CRM get a service account with broad API scopes and none of the rest. Under NIS2, an agent with write access to customer data is an identity, an access path and, when a third party supplies it, a supply chain dependency.
Pragmatic Playbook for Enterprise CX Buyers
NIS2 will not tell you how to run your CRM. It does tell your board who pays when it fails. There are three things you should settle soon.
Map every connection into your customer data. Inventory integration users, partner portals, marketplace connectors and agent credentials with write access to CRM and ERP and other business systems. Ask each vendor and partner for their NIS2 evidence and for their own suppliers one level down. Where a partner cannot produce it, move it from direct write access to a defined interface or a data exchange layer.
Test the restore, not the backup. Demand documented recovery time and recovery point objectives from your CRM vendor, and run a restore with your own data at least once a year. Put the results in front of management, because under NIS2 they own this risk. A backup nobody has restored is a hope, not a control.
Give every AI agent an employment record. Before an agent touches customer data, define its role, its least-privilege scopes, the human who approves consequential actions, and how it gets switched off. Require per-action audit logs from the vendor and contractual clarity on which jurisdiction can compel access to the data the agent processes. If the vendor cannot show you on whose behalf the agent acted and why, it is not ready for production.
Compliance is a document. Resilience is a habit.